Commit 967f0a7061c for nodejs

commit 967f0a7061cb4a379279b2f65be9c1a81c679c40
Author: Rafael Gonzaga <rafael.nunu@hotmail.com>
Date:   Tue Oct 20 13:26:16 2026 -0300

    src,permission: do not grant cwd read access without entrypoint

    Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
    PR-URL: https://github.com/nodejs/node/pull/66645
    Reviewed-By: James M Snell <jasnell@gmail.com>

diff --git a/src/env.cc b/src/env.cc
index d5b3b466f76..33e2121d45f 100644
--- a/src/env.cc
+++ b/src/env.cc
@@ -1177,7 +1177,7 @@ Environment::Environment(IsolateData* isolate_data,
         }
       }

-      if (first_argv != "inspect") {
+      if (!first_argv.empty() && first_argv != "-" && first_argv != "inspect") {
         options_->allow_fs_read.push_back(first_argv);
       }
     }
diff --git a/test/parallel/test-permission-fs-read-entrypoint.js b/test/parallel/test-permission-fs-read-entrypoint.js
index 631c793e135..f0182dce645 100644
--- a/test/parallel/test-permission-fs-read-entrypoint.js
+++ b/test/parallel/test-permission-fs-read-entrypoint.js
@@ -14,6 +14,7 @@ if (!common.hasCrypto) {

 const assert = require('assert');
 const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
 const { spawnSync } = require('child_process');

 const file = fixtures.path('permission', 'hello-world.js');
@@ -36,3 +37,19 @@ const fsReadLoader = fixtures.path('permission', 'fs-read-loader.js');
   );
   assert.strictEqual(status, 0, `${arg0} Error: ${stderr.toString()}`);
 });
+
+// When the code is read from stdin there is no entrypoint, so no implicit
+// read access should be granted (in particular, not to the cwd).
+tmpdir.refresh();
+[
+  ['--permission'],
+  ['--permission', '-'],
+].forEach((args) => {
+  const { status, stdout, stderr } = spawnSync(process.execPath, args, {
+    cwd: tmpdir.path,
+    input: 'console.log(process.permission.has("fs.read", ' +
+           'require("path").join(process.cwd(), "x")))',
+  });
+  assert.strictEqual(status, 0, `${args} Error: ${stderr.toString()}`);
+  assert.strictEqual(stdout.toString().trim(), 'false');
+});